ThyssenKrupp suffers professional hack attack

GERMAN engineering conglomerate ThyssenKrupp has had project data stolen in a “professional” cyber attack.

The attack originated in Southeast Asia and while the company says it is “not yet clear” exactly what has been stolen it can confirm that certain project data in an operative engineering company and other fragments of data have been taken.

ThyssenKrupp says that security deficiencies and human error are not responsible for the attack.

“Experts say that in the complex IT landscapes of large companies, it is currently virtually impossible to provide viable protection against organised, highly professional hacking attacks,” the company said in a statement.

The aim was to “steal technological know-how and research” from the company’s business unit that designs, builds and operates steel, chemicals, mining and cement plants. There are no signs of sabotage, and the company stressed that its “specially-secured IT systems” for units that operate blast furnaces and build warships were not affected.

The attack took place in February this year but was not discovered until April. A company spokesperson told The Chemical Engineer that it usually takes 150 to 200 days to discover such breaches so in this instance the company encountered the attack rather quick.

The company has filed charges with Germany’s State Office for Criminal Investigation and has been working with a cyber-security organisation called DCSO which was established last year by industrial giants including BASF and Bayer to improve the country’s cyber security. Since the attack, ThyssenKrupp’s affected IT systems have been “revised”.

In 2014, German authorities revealed that hackers had forced an unnamed German steel mill into an uncontrolled shutdown that caused massive damage to the plant. While it’s been widely reported that ThyssenKrupp was the victim of that attack, a company spokesperson told The Chemical Engineer that an external audit has proved this claim is untrue.

In May this year, US Steel accused Chinese government hackers of stealing trade secrets related to its production of advanced high-strength steel and sharing them with Chinese producers.